diff --git a/package/uboot-tools/Config.in b/package/uboot-tools/Config.in
index e8bbf3a16e..d0e255615e 100644
--- a/package/uboot-tools/Config.in
+++ b/package/uboot-tools/Config.in
@@ -12,6 +12,7 @@ config BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
 	depends on !BR2_STATIC_LIBS
 	select BR2_PACKAGE_DTC
 	select BR2_PACKAGE_DTC_PROGRAMS
+	select BR2_PACKAGE_OPENSSL
 	help
 	  Enables support for Flattened Image Tree (FIT).
 
@@ -21,17 +22,6 @@ config BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
 	  in a single blob. To boot this new uImage structure,
 	  pass the address of the blob to the "bootm" command.
 
-comment "u-boot tools FIT support needs a toolchain w/ dynamic library"
-	depends on BR2_STATIC_LIBS
-
-if BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
-
-config BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
-	bool "FIT signature verification support"
-	select BR2_PACKAGE_OPENSSL
-	help
-	  Enables support for FIT Signature Verification.
-
 	  Flat Image Trees (FIT) supports hashing of images so that
 	  these hashes can be checked on loading. This protects
 	  against corruption of the image. However it does not prevent
@@ -47,6 +37,11 @@ config BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
 	  libcrypto, and possibly GPL/OpenSSL licensing
 	  incompatibility issues.
 
+comment "u-boot tools FIT support needs a toolchain w/ dynamic library"
+	depends on BR2_STATIC_LIBS
+
+if BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT
+
 config BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN
 	bool "fit_check_sign"
 	depends on BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
diff --git a/package/uboot-tools/Config.in.host b/package/uboot-tools/Config.in.host
index 622070405d..3715be4d6e 100644
--- a/package/uboot-tools/Config.in.host
+++ b/package/uboot-tools/Config.in.host
@@ -10,6 +10,7 @@ if BR2_PACKAGE_HOST_UBOOT_TOOLS
 config BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT
 	bool "Flattened Image Tree (FIT) support"
 	select BR2_PACKAGE_HOST_DTC
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
 	help
 	  Enables support for Flattened Image Tree (FIT).
 
@@ -19,13 +20,6 @@ config BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT
 	  in a single blob. To boot this new uImage structure,
 	  pass the address of the blob to the "bootm" command.
 
-if BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT
-
-config BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
-	bool "FIT signature verification support"
-	help
-	  Enables support for FIT Signature Verification.
-
 	  Flat Image Trees (FIT) supports hashing of images so that
 	  these hashes can be checked on loading. This protects
 	  against corruption of the image. However it does not prevent
@@ -37,8 +31,6 @@ config BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT
 	  public key is stored in a non-volatile place, any image can
 	  be verified in this way.
 
-endif # BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT
-
 config BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE
 	bool "Environment image"
 	help
diff --git a/package/uboot-tools/uboot-tools.mk b/package/uboot-tools/uboot-tools.mk
index 12e10dea91..d2a85ab061 100644
--- a/package/uboot-tools/uboot-tools.mk
+++ b/package/uboot-tools/uboot-tools.mk
@@ -34,13 +34,13 @@ UBOOT_TOOLS_MAKE_OPTS = CROSS_COMPILE="$(TARGET_CROSS)" \
 	STRIP=$(TARGET_STRIP)
 
 ifeq ($(BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT),y)
-UBOOT_TOOLS_MAKE_OPTS += CONFIG_FIT=y CONFIG_MKIMAGE_DTC_PATH=dtc
-UBOOT_TOOLS_DEPENDENCIES += dtc
-endif
-
-ifeq ($(BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),y)
-UBOOT_TOOLS_MAKE_OPTS += CONFIG_FIT_SIGNATURE=y CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
-UBOOT_TOOLS_DEPENDENCIES += openssl host-pkgconf
+UBOOT_TOOLS_MAKE_OPTS += \
+	CONFIG_FIT=y \
+	CONFIG_FIT_CIPHER=y \
+	CONFIG_FIT_SIGNATURE=y \
+	CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000 \
+	CONFIG_MKIMAGE_DTC_PATH=dtc
+UBOOT_TOOLS_DEPENDENCIES += dtc openssl host-pkgconf
 endif
 
 ifeq ($(BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE),y)
@@ -123,13 +123,13 @@ HOST_UBOOT_TOOLS_MAKE_OPTS = HOSTCC="$(HOSTCC)" \
 	CONFIG_EFI_HAVE_CAPSULE_SUPPORT=y
 
 ifeq ($(BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT),y)
-HOST_UBOOT_TOOLS_MAKE_OPTS += CONFIG_FIT=y CONFIG_MKIMAGE_DTC_PATH=dtc
-HOST_UBOOT_TOOLS_DEPENDENCIES += host-dtc
-endif
-
-ifeq ($(BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT),y)
-HOST_UBOOT_TOOLS_MAKE_OPTS += CONFIG_FIT_SIGNATURE=y CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
-HOST_UBOOT_TOOLS_DEPENDENCIES += host-openssl
+HOST_UBOOT_TOOLS_MAKE_OPTS += \
+	CONFIG_FIT=y \
+	CONFIG_FIT_CIPHER=y \
+	CONFIG_FIT_SIGNATURE=y \
+	CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000 \
+	CONFIG_MKIMAGE_DTC_PATH=dtc
+HOST_UBOOT_TOOLS_DEPENDENCIES += host-dtc host-openssl
 define HOST_UBOOT_TOOLS_INSTALL_FIT_CHECK_SIGN
 	$(INSTALL) -m 0755 -D $(@D)/tools/fit_check_sign $(HOST_DIR)/bin/fit_check_sign
 endef
